Privacy Policy

2. Data We Collect

2a. Account Data (we are data controller)

• •Name, email address, and organization name provided at registration
• •Billing information (processed and stored by Stripe, we never store raw card data)
• •Login activity, session metadata, and IP addresses for security purposes
• •Aggregate feature-usage analytics (no individual behavioral profiling)

2b. Customer-Uploaded Data (you are data controller)

• •Survey responses, email content, voice recordings, and any other data you upload
• •Respondent identifiers (if provided by you)
• •Classification labels, tags, and analysis outputs generated from your data

2c. Publicly Collected Brand Monitoring Data (you are data controller)

When you use the Brand Monitor feature, the platform collects publicly available content about brands you choose to track. This includes your own brands and, if you choose, competitor brands.

• •Text snippets from public forums, editorial sites, review platforms and social media that mention the brand name
• •Source URL, source name, and approximate date of the mention
• •Author type (e.g. homeowner, contractor) when identifiable from context, but never the author's name, username, or contact information
• •Sentiment, theme classification, and other analysis outputs generated by the platform

2d. Website Visitor Data (we are data controller)

When you visit our marketing website (statquestions.com), we collect certain data to understand which businesses are interested in our product. This does not apply inside the signed-in platform.

• •Your IP address, which we use to identify the company you are visiting from
• •We send your IP address to ipinfo.io, which returns the company name and location associated with it
• •We may then send the company domain to Hunter.io, which returns publicly available business contact information (names, job titles, email addresses and LinkedIn profile URLs) for people at that company
• •This information is stored and used for our own sales outreach. It is never combined with data you upload to the platform as a customer

3. Legal Basis for Processing (GDPR)

Where GDPR applies, we process your personal data under the following lawful bases:

• •Contract performance: To provide, maintain, and support the StatQuestions service you have contracted with us for
• •Legitimate interests: To improve platform security, prevent fraud, and develop our services
• •Legal obligation: To comply with applicable laws, regulations, and lawful requests from authorities
• •Consent: For optional communications such as product newsletters (you may withdraw consent at any time)

4. How We Use Data

• •Delivering the platform's core features: analysis, dashboards, reporting
• •Processing payments and managing subscriptions via Stripe
• •Sending transactional communications (receipts, service notices, security alerts)
• •Improving platform reliability, performance, and security
• •Complying with legal obligations and enforcing our Terms of Service

5. Data Sharing & Sub-Processors

We share data only with the sub-processors named below. Each works under a written data protection agreement, each performs one defined function, and none receives your data for its own purposes. All are located in the United States except where noted.

• •Supabase, Database and platform backend (US). This is where data you upload is stored.
• •Amazon Web Services (S3), Voice call recording storage (US)
• •Base44, Application hosting, authentication and deployment
• •Cloudflare, DNS, content delivery and SSL termination (US)
• •Deepgram, Speech-to-text transcription for voice analysis
• •Anthropic, Language model, used only on the small share of records our deterministic rules cannot categorize. Before text is sent we reduce the sender to its domain and mask email addresses and phone numbers in the body. Anthropic's commercial terms prohibit training models on customer content.
• •Resend, Delivery of scheduled reports and notifications
• •Stripe, Card payment processing. Receives billing details only, never data you upload.
• •Hunter.io, Email finder service, used to identify business contacts at companies that visit our marketing website. Receives company domain names only, never customer feedback data you upload.
• •ipinfo.io, IP geolocation, used to identify the company associated with a visitor's IP address on our marketing site. Never receives customer feedback data.
• •Microsoft Graph API, Email integration, used when customers connect their Microsoft 365 account to import feedback from their inbox. Receives only the email content the customer authorizes.
• •Salesforce REST API, CRM integration, used when customers connect their Salesforce account to import customer records. Receives only the data the customer authorizes.

We will give customers advance notice before adding or replacing a sub-processor that handles uploaded content.

We may also disclose data if required to do so by law, court order, or governmental authority.

We do not sell, rent, or trade your personal data to any third party.

6. Data Security

• •All data is encrypted in transit (TLS) and at rest (AES-256)
• •Role-based access controls restrict data access to authorized personnel only
• •Each organization's data is logically isolated from others
• •Regular security reviews and access audits

7. Data Retention

• •Uploaded content: Because you are the controller of this data, you set its retention period and we delete on that schedule. If you have not set one, content is kept while your account is active so that historical comparison remains possible, and you can ask us to delete it at any time.
• •Raw intermediate files: Working copies created during processing, such as raw transcript payloads already written into your analysis, are deleted within 30 days.
• •Active account data: Retained for the duration of your subscription
• •Post-cancellation: Data is retained for 30 days to allow export, then permanently deleted
• •Billing records: Retained for 7 years as required by applicable tax and financial regulations
• •Security logs: Retained for up to 12 months for fraud prevention and audit purposes

Payment card numbers and government identification numbers are never retained. Where these appear in free-text content you upload, they are detected and replaced at the moment of writing, before the record is stored.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• •Access (GDPR Art. 15): Request a copy of the personal data we hold about you
• •Rectification (GDPR Art. 16): Correct inaccurate or incomplete data
• •Erasure (GDPR Art. 17): Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements
• •Portability (GDPR Art. 20): Receive your data in a machine-readable format
• •Restriction (GDPR Art. 18): Request we limit how we process your data
• •Objection (GDPR Art. 21): Object to processing based on legitimate interests
• •California (CCPA): Rights to know, delete, opt-out of sale, and non-discrimination
• •Texas (TDPSA): Rights to access, correct, delete and port your data; right to opt out of the sale of personal data, targeted advertising and profiling
• •Nebraska: Same rights as Texas. Nebraska's data privacy law applies regardless of company size or data volume

To exercise your rights, email privacy@statquestions.com. We will respond within 30 days. We may need to verify your identity before processing your request.

If you believe we have not adequately addressed your concern, you have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your relevant EU supervisory authority).

9. International Data Transfers

StatQuestions is operated from the United States and every sub-processor listed above is located in the United States. Data you upload is stored in AWS US East. If you, or the people your data describes, are located outside the United States, that data is transferred to and processed in the United States.

European Economic Area and United Kingdom: where required we rely on Standard Contractual Clauses approved by the European Commission, or the UK International Data Transfer Addendum, together with supplementary measures.

Canada: we process personal information in the United States. Canadian customers should know that while their information is outside Canada it may be accessible to courts and government authorities in the United States under the laws of that country. We handle Canadian personal information consistently with PIPEDA.

Quebec: in most engagements we receive data that our customer has already moved outside Quebec into its own systems, and the assessment Quebec's Law 25 expects before personal information is communicated outside the province is the customer's to make, not ours. What we owe our customers is the information they need to make it, and we provide that on request: what we hold, which sub-processors receive it, where it is stored, what protects it, and how long it is kept.

Where we are the party communicating personal information out of Quebec, for example where a Quebec-based customer sends data to us directly, we complete that assessment ourselves before the transfer. Either way, Quebec customers can request our current data protection summary from the address below.

10. Cookies & Tracking

Our public website uses cookies for analytics and advertising measurement. The signed-in product does not: inside the platform we use only the cookies needed to keep you logged in. We do not sell your data, and we do not use the contents of your customer feedback for advertising.

• •Session cookies: Required for login and platform functionality.
• •Google Analytics 4: Which pages are visited and for how long, so we can see what is useful. Sets _ga and _ga_*.
• •Google Ads: Tells us which advert led to a demo booking or a purchase. Sets _gcl_au, _gcl_aw and GCL_AW_P.
• •Warmly: Identifies the company a website visitor is browsing from, so we know which businesses are looking at us. It does not read anything you have stored in the platform.

On your first visit, a consent banner asks whether you accept non-essential cookies. Analytics, advertising and visitor-identification cookies are loaded only after you click Accept. If you click Decline, those scripts never run and no tracking cookies are set. You can also block cookies in your browser or with any standard blocker, and the site will still work. Blocking them does not affect your account.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or a prominent notice on the platform at least 30 days before taking effect. Continued use of StatQuestions after the effective date constitutes acceptance of the updated policy. We recommend reviewing this page periodically.